2026-07-25NOTABLEMicrosoft's quarterly email report flags a sustained shift of social engineering into Teams voice-phishing
Microsoft Defender for Office 365
product · product:microsoft-defender-for-office-365 single-source
Coverage
1
first 2026-07-25 → last 2026-07-25
Latest activity
2026-07-25
Microsoft's quarterly email report flags a sustained shift of social engineering into Teams voice-phishing
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance, telco
Sources cited
1
1 hosts
Defender insights
What each entry about Microsoft Defender for Office 365 tells a defender to do, newest first.
Triage
Story timeline
ATT&CK techniques (4 across 3 tactics)
4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessPhishing · Phishing: Spearphishing Voice
- Credential AccessSteal Application Access Token · Adversary-in-the-Middle
- CollectionAdversary-in-the-Middle
Initial Access TA0001
T1566Phishing×1
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗
T1566.004Phishing: Spearphishing Voice×1
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗
Credential Access TA0006
T1528Steal Application Access Token×1
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗
T1557Adversary-in-the-Middle×1
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗
Collection TA0009
T1557Adversary-in-the-Middle×1
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Evidence: 2026-07-25/microsoft-email-threat-landscape-q2-2026-teams-vishing-surge · ATT&CK page ↗
Entries about Microsoft Defender for Office 365 (1)
Where this entity is cited
Source distribution
- microsoft.com1 (100%)